Skip to content

OINK v0.7.1 — Security and validation hardening

Choose a tag to compare

View all tags
@Vonng Vonng released this 26 Aug 06:18
· 22 commits to main since this release
v0.7.1
9abf750

OINK 0.7.1 is a security and validation patch with no component API change. It closes the code findings from an external review of the 0.7.0 line.

Highlights

  • Swagger UI no longer contacts the online validator. The initializer pins validatorUrl: null and moves to a cacheable js/chunks/swagger-init.js, so a same-origin spec page makes no third-party request.
  • Configured URL surfaces route through the shared URL policy. params.ui.page_context_menu.links and params.url_latest_version warn and drop an unsafe value instead of rendering it, and the archived-version banner escapes its URL at the sink.
  • Invalid configuration warns and falls back. Numeric and boolean keys — blog/section index sizes and columns, sidebar widths, print options, offline-search limits, and more — no longer crash hugo server or emit broken CSS; a shared integer validator reads values as base-10 with bounds.
  • OpenAPI and asciinema honor the output contract. The swagger, redoc, and asciinema shortcodes emit a static link in print, Markdown, and RSS, and register their runtime only in interactive HTML.
  • Generated configuration schemas match what Hugo parses. Trailing comments no longer leak into defaults, and migration-only keys stay out of the front-matter schema.

Upgrade

hugo mod get github.com/pgsty/oink@v0.7.1
hugo mod tidy

No content, configuration, or template changes are required. Invalid configuration values that used to build silently now warn — run a --panicOnWarning build to surface any that a publishing gate would catch.

OINK 0.7.1 是一个安全与校验修补版本，不改动任何组件 API，修复了对 0.7.0 主线外部审查发现的代码问题：

  • Swagger UI 不再联系在线 validator：初始化写死 validatorUrl: null 并移入可缓存的 js/chunks/swagger-init.js，同源 spec 页面不再发起第三方请求。
  • 配置中的 URL 走统一安全策略：page_context_menu.links 与 url_latest_version 对非法值告警并丢弃，归档版本横幅在输出处转义。
  • 非法配置告警并回退：数值与布尔配置键（博客/章节索引的分页大小与列数、侧栏宽度、打印选项、离线搜索上限等）不再击穿 hugo server 或输出坏 CSS；共享整数校验器以十进制读取并带范围约束。
  • OpenAPI 与 asciinema 遵守输出契约：swagger、redoc、asciinema 在 print/Markdown/RSS 输出静态链接，仅在交互 HTML 中装载运行时。
  • 生成的配置 Schema 与 Hugo 实际解析一致：行尾注释不再污染默认值，仅供迁移告警读取的键不再出现在 front matter Schema 中。

升级方式与英文一致；非法配置从静默构建改为告警，建议用 --panicOnWarning 构建检查发布门禁会拦截的项。

Assets 2
Loading